CVE-2026-102108 Kiteworks Email Protection Gateway deserialization of untrusted data

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

CVE-2026-102108 Kiteworks Email Protection Gateway deserialization of untrusted data

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

CVE-2026-102108

The Kiteworks Email Protection Gateway is vulnerable to a deserialization of untrusted data flaw. An authenticated administrator with specific queue-management privileges could submit a crafted serialized object to a cluster management interface . Due to insufficient validation during deserializa...

CVE-2026-102109

A SQL injection vulnerability exists in Kiteworks Secure Data Forms . The root cause is the improper sanitization of a value derived from an authenticated user's stored account data when incorporated into a database query. Exploitation requires an authenticated session and is only applicable to d...

CVE-2026-102109 Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102109 Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102110

A Kiteworks appliance is vulnerable to a missing authentication flaw in a setup function used during initial activation . An unauthenticated network attacker can repeatedly re-trigger the privileged activation process during this specific window because the endpoint fails to enforce intended stat...

CVE-2026-102110 Missing authentication on a Kiteworks appliance setup function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

CVE-2026-102110 Missing authentication on a Kiteworks appliance setup function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

CVE-2026-102111 Kiteworks Core Improper Validation of Specified Quantity in Input

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...

CVE-2026-102111

The Kiteworks Core software contains a vulnerability where it fails to enforce the maximum permitted value for a configurable security-policy setting . An authenticated administrator can set this value outside its intended range, causing the associated security control to remain silently ineffect...

CVE-2026-102111 Kiteworks Core Improper Validation of Specified Quantity in Input

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...

CVE-2026-102112 Kiteworks Core Local Privilege Escalation

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to...

CVE-2026-102112

A privilege escalation vulnerability exists in Kiteworks , where an attacker with existing local access and code execution as an unprivileged backend service account on the appliance can escalate to root privileges. This allows the attacker to run arbitrary commands with the highest privileges. T...

CVE-2026-102112 Kiteworks Core Local Privilege Escalation

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to...

CVE-2026-102113 Kiteworks Core Local Privilege Escalation

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could...

CVE-2026-102113

A privilege escalation vulnerability exists in Kiteworks where an attacker with local code execution as an unprivileged backend service account on the appliance can escalate to root privileges. The root cause is a privileged routine that fails to safely handle a filesystem path influenced by the ...

CVE-2026-102113 Kiteworks Core Local Privilege Escalation

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could...

CVE-2026-102114 Kiteworks Core OS Command Injection

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102114 Kiteworks Core OS Command Injection

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...